| # | Recommendation | Actions | Priority High/ Low/ Medium | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|-----------------------------|----------------|----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------| | R1 | DECC must ensure that where key services are procured under SLAs that knowledge and information continuity risks are monitored and reported periodically to the Shared Services Integration Project Board. This may be achieved by:

- Defining a set of metrics for contract monitoring
- Agreeing a timetable for reporting | Action 1.1: Digital continuity risks to be formally introduced into SLA requirements. | Med | January 2013 | Head of KM | Consultation with the KIM team on such risks is now normal practice. The DECC Development Programme (addressing the recommendation of the recent Capability Review) will ensure that this is formally embedded into the processes for developing SLA requirements | No | | R2 | DECC to develop an implementation plan, including timeline and benefits realisation, for the Knowledge-Sharing Strategy. This may be achieved by:
- A detailed project plan with agreed milestones
- Regular updates to a relevant change programme or project board. | | High | Complete | Head of KIM | An implementation plan was agreed in September 2011 and is due for review in October 2012. Progress is reported quarterly to The KIM Steering Group, and progress against major milestones is reported monthly to the Chief operating Officer. | Yes | | R3 | The KIM team should modify and review the EDRMS metrics so that they continue to challenge and raise EDRMS use. This may be achieved by:
- Including, number of documents into the EDRMS, when updated, number of emails filed etc | | High | Complete | Head of KIM | DECC’s Operational Business Plan contains a KPI for EDRMS use - 80% of staff to be an active user by March 2013. The number of records which must be saved to qualify as an active user has been increased from 1 to 4 per month. | Yes | | R4 | KIM team to review how the profile | Action 4.1: restate the | Med | Complete | Head of 4.1 In May 2012 the Chief | Yes | of the IM role can be raised. This may be achieved by:
- Reviewing training requirements for the role
- A community of practice section on the Intranet
- Restate the importance of the role to managers

| Action 4.2: Reviewing the training requirements of the role | Med | January 2013 | Head of KIM | DECC’s EDRMS is due to be upgraded, and technical training requirements will be assessed once this has happened. IMs have developed training courses on remote working which they deliver for their teams. | No | | Action 4.3 A community of practice section on the Intranet | Low | June 2013 | Head of KIM | DECC has just implemented a new intranet. Initially this will not support communities of practice, but it is intended to introduce this functionality in the future. The IMs already operate as an informal network (they are known collectively as the IM Network) seeking and sharing expertise. | No | | R5 KIM team to assess how the expertise of the IMs can be raised to meet the department’s information needs. This may be achieved by; See recommendation 4 above | Action 5.1: Raise expertise of IMs | Med | Ongoing | Head of KIM | Monthly IM Network meetings have a standing agenda item to identify new training needs, prioritising most common areas of concern for end users. As mentioned above, IMs have developed training courses on search and remote working which they deliver to their teams. | Ongoing | | R8 | DECC should use the Digital Continuity Guidance produced by The National Archives to expand its Information Asset Register to create a management tool to support the management of information over time and through change. This may be achieved by:

- Reference the Digital Continuity guidance to support on the National Archives Website | Action 8.1: DECC staff to attend Digital Continuity training at TNA | High | Nov 2012 | Head of KIM | No | | R9 | DECC should put in place a programme to train the IAOs and raise awareness of the role and its responsibilities. This may be achieved by:
- Using the Digital Continuity guidance as a basis for the training
- Reviewing how the IAO role has been assigned within DECC | Action 9.1: IAO training and awareness | High | Complete | Departmental Security Officer | Yes | | R10 | Information related to business critical assets within the IAR must be tied into departmental business continuity planning. This may be achieved by:
- Reference to the Digital Continuity guidance | Action 9.2 Amend IAO training to include digital continuity, Transparency and changes to GPMS | High | March 2013 | Departmental Security Officer | No | | R11 | DECC should use The National Archives’ guidance to develop a What to Keep schedule for the department. This may be achieved by:
- Utilising the available professional support and guidance to assess best practice and use examples from other government departments | Action 11.1 Review existing generic guidance on what information to manage in Matrix. | Med | Dec 2012 | Head of KIM | No |

1 http://www.nationalarchives.gov.uk/documents/information-management/customer-guide-to-framework.pdf | Action | Description | Priority | Completion Date | Responsible | Notes | |--------|-------------|----------|-----------------|-------------|-------| | R12 | DECC to conduct a review of information held on personal drives and consider introducing a size limit. This may be achieved by:

- By linking the information from the IAR, information on ICT systems.
- Use the knowledge of the in house IT staff, contractors, IMs, IARs and managers to collate this information | Medium | March 2013 | Head of KIM | We are undertaking a review of the use of these drives to better understand their content and the reasons behind their use. We anticipate that this, supported by revised EDRMS metrics and communications plan, and the new EDRMS/SharePoint interface mentioned above, will significantly reduce the amount of information held in repositories other than the EDRMS. | | R13 | DECC should ensure that IMs are empowered to challenge staff over poor naming of documents and encourage colleagues to follow departmental guidance. This may be achieved by:
- Refer to recommendation 4 above | High | Complete | Head of KIM | In May 2012 the Chief Operating Officer reiterated the importance of the IM role to all DGs and Directors (the message also mandated EDRMS use for all corporate records, and that it is the responsibility of managers to ensure this happens). | | R14 | DECC needs to increase usage of the EDRMS and enforce limits on exceptions to the policy and communicate to all. This would be supported by:
- Limiting personal drive sizes
- Reviewing the provision of shared drives to business units
- Using IMs and middle managers to drive compliance | High | Complete | Head of KIM | EDRMS use for corporate records is mandated by the Permanent secretary, and any exceptions must be approved by the KIM team. See recommendations 3 and 12 above for other initiatives to increase EDRMS use. | | R15 | The KIM team to develop appraisal criteria for legacy records. This may be achieved by:
- See recommendation 11 above | Action 15.1: Develop appraisal criteria for legacy records | Med | Dec 2012 | Head of KIM | DECC is working with BIS, its shared service provider, to review all records over 8 years old by the end of 2012. This will provide appraisal criteria, which can be applied to newer records covering the same the functions, as well as those included in the current exercise.\
  The appraisal methodology has been approved by TNA and records for permanent preservation have already been identified for transfer to Kew. | No | | R16 | The KIM team need to ensure that KIM guidance references all record types, including legacy paper records. This may be achieved by:
- Update current records and information guidance. | Action 16.1: Update KIM guidance to include reference to legacy paper records | Med | Dec 2012 | Head of KIM | No | | R17 | The KIM team to liaise with the Private Offices in the implementation of an annual audit as referenced within The National Archives’ guidance to ensure that they are operating effectively. This may be achieved by:
- Reference to Guidance on the Management of Private Office Papers² | Action 17.1: Undertake audit | Med | Nov 2012 | Head of KIM | No | | | | Action 17.2: Report and recommendations | Dec 2012 | Head of KIM | No | | | | Action 17.3: Implement recommendations | Jan 2013 | Head of KIM | No | | R18 | The KIM Team and ICT should audit email inboxes to provide the base to identify and mitigate the risk of poor | N/A | | | Current DECC policy does not allow access to individual's email accounts | No |

² [http://www.nationalarchives.gov.uk/documents/information-management/popapersguidance2009.pdf](http://www.nationalarchives.gov.uk/documents/information-management/popapersguidance2009.pdf) email management. This may be achieved by:

- Use of available metrics available on use of the EDRMS and that provided by IT

| R19 | DECC to develop a strategy for managing digital continuity drawing on expertise from all relevant teams within the department. This may be achieved by;

- See Recommendation 8 above | Action 19.1 Produce Digital Continuity Strategy and implementation plan | Med | Dec 2012 | Head of KIM | DECC will complete a strategy, in line with the review of its Information Asset Register by December 2012. Digital continuity will also be added to IAO training | No |

| R20 | DECC to embed digital continuity into the IT change management process, with a digital continuity impact assessment as a core component. This may be achieved by;

- See Recommendation 8 above | Action 20.1: Embed digital continuity requirements into PPM processes | Med | January 2013 | Head of KIM/Head of IT | Consultation with the KIM team is now normal practice when new IT requirement are being developed. The DECC Development programme will ensure that this is formally embedded into the processes for developing requirements | No |

| R21 | DECC to develop a technology roadmap for MATRIX, continuing to engage suppliers and pilot new approaches to identify options. This | Action 21.1: Upgrade EDRMS | High | March 2013 | Head of KIM./CIO/BIS | The EDRMS is provided to DECC by BIS as part of shared service. An upgrade is planned in March 2013 | No | may be achieved by:

- See Recommendation 8 above

| Action 21.2: Programme to integrate EDRMS with SharePoint 2010 | Med | Scheduled to start from April 2013 | Head of KIM | which will allow DECC to integrate the EDRMS with SharePoint 2010. DECC’s current IT contract ends in March 2014. Planning for the provision of a new service is well advanced, and includes EDRMS provision. As part of this exercise DECC has assumed continuation of the EDRMS service provided by BIS. However, we are also assessing other options (for example services available in the G-Cloud) to confirm that the shared service continues to provide the best overall EDRMS solution for DECC. | | R22 | DECC to include digital continuity requirements in the specification and procurement of new systems to cover interoperability, data exchange and extraction and standardised technology. This may be achieved by:

- See Recommendation 8 above | Action 22.1: Embed digital continuity into procurement of new systems | Med | January 2013 | Head of KIM/Head of IT | This is interlinked with the action for recommendation 20 above. Consultation with the KIM team is now normal practice when new IT requirement are being developed. The DECC Development programme will ensure that this is formally embedded into the processes for developing requirements | | R23 | DECC to review how data protection training is cascaded and implemented to ensure personal information is held and managed effectively. This may be achieved by:
- Reviewing the attendance of the courses | Action 23.1: review completion of online data handling training | High | Complete | Departmental Security Officer | 86% of DECC staff completed the mandatory level 1 training in 2011. A target of 90% has been set for 2012 and is championed by the SIRO. Managing personal and | | R24 | DECC should work within the BIS SLA to refresh the FoI training and develop an communication programme for staff. | Action 24.1: Review FOI training content with BIS | High | Complete | Head of KIM | BIS provide tailored, high level briefings for teams in DECC as requested | Yes | | R24 | | Action 24.2: Communication programme on FOI | High | Complete | Head of KIM | There have been three FOI communication exercises since the completion of the IMA | Yes | | R24 | | Action 24.3: Provide specialist FOI/EIR training from DECC staff as part of L&D package | Med | Oct 2012 | Head of KIM | More detailed training in both FOI and EIRs will be available as part of DECCs Learning and Development Programme from October 2012. | No | | R25 | KIM team to develop access control auditing processes | Action 25.1: Develop access control auditing process | Med | Dec 2012 | Head of KIM | These will be produced jointly with the Security team | No | | R26 | The KIM team to mandate the minimum record standards to be kept and incorporate them into WTK and KIM guidance. This may be achieved by;
- See recommendation 11 above | Action 26.1: Mandate use of EDRMS for corporate records | High | Complete | Head of KIM | Use of the EDRMS for corporate records is mandated by the permanent Secretary, and in part enforced by compliance with Cabinet Office guidance on the management of Private Office records, as all submission to ministers and the permanent secretary must be submitted as EDRMS links. | Yes | | R26 | | Action 26.2: Review current guidance on what records to store in EDRMS | Med | Dec 2012 | Head of KIM | | No | | R26 | | Action 26.3: Produce What to Keep guidance | Med | April 2013 onwards | Head of KIM | DECC will introduce new guidance on what to keep as part of the larger programme to integrate the EDRMS and SharePoint 2010, scheduled to start in 2013. | No | | R27 | DECC should explore what | Action 27.1: Raise | High | January 2013 | Department | DECC will now focus on | No | | R28 | DECC should review, delete and rebrand BIS or Defra Intranet content. This may be achieved by; Can be incorporated into the ongoing refresh of record and information management guidance, and the review of ongoing review of EDRMS training. | Action 28.1: new DECC intranet | Med | Complete | Head of KIM | A new intranet is now in place | Yes | | R29 | DECC should assess how induction training can be improved within available resources to meet departmental needs. | Action 29.1: Review induction training | Med | Complete | Head of KIM | KIM induction training has been reviewed and is now presented jointly with security team to cover IA issues. | Yes | | R30 | The KIM team to input into the BIS Matrix training as part of the SLA review. This may be achieved by; ● Agree content to cover DECC WTK guidance and records and information management | Action 30.1: Review Matrix training | Med | April 2013 | Head of KIM | Matrix training will be reviewed following the planned upgrade of the EDRMS. | No | | R31 | DECC should develop and implement a formal knowledge capture process to include access to that information once recorded. This may be achieved by; ● Creating a template that includes set questions ● Ensure that staff and managers know when and who must complete it. | Action 31.1: Develop and publicise knowledge transfer processes | High | Complete | Head of KIM | DECC now has guidance on knowledge transfer (including a template and set questions), Peer Assists, After Action Reviews and Lunch and Learn sessions on its intranet. These will be supported by a series of KIM awareness sessions across the Department. Lessons learned is also being built into DECC’s PPM processes as part of the DECC Development Programme. | Yes |